Hi @Eric_G ,
@PhoneBoy question about the gateway version is very likely the key to this, and here's why:
Per sk166415 — which is the SK the CVE advisory itself points to for client compatibility — "Remote Access VPN clients support IKEv2 starting from Endpoint Security Client version E88.40 and Security Gateway version R82."
So if your cluster is R81.20 or R81.10, IKEv2 for Remote Access isn't supported on the gateway side, and switching the Encryption method to Prefer IKEv2, support IKEv1 would push clients into an IKEv2 negotiation the gateway can't complete — which matches your symptom exactly (site creation and trust work fine, the freeze happens at connect, i.e. during IKE negotiation). Your client side is fine: E89.20 is well above the E88.40 minimum.
First thing I'd do: revert just the Encryption method back to its previous value, install policy, and test the macOS client. If it connects, you've confirmed the trigger in one step — then you can decide on a mitigation that doesn't depend on IKEv2.
On your question about local client config: sk166415 documents a disable_ikev2 flag — on macOS it's in the HKLM_registry.data file (change 4[1] to 4[0]), on Windows it's HKLM\SOFTWARE\WOW6432Node\CheckPoint\TRAC. But note: starting from E89.00 that step is no longer required, so on E89.20 there's nothing you need to change locally. Worth knowing so you don't go chasing client-side config that isn't the issue.
Separately — and I'd flag this as important — I think your current settings may not actually mitigate the CVE. Comparing them against sk185033 (the official advisory for CVE-2026-50751), the SK says to implement one of three options, exactly as specified:
- Option 1 – Gateway object > VPN Clients > Authentication → clear the Allow older clients to connect to this gateway checkbox (and the same under Mobile Access > Authentication if Mobile Access is enabled).
- Option 2 – Global properties > Remote Access > VPN Authentication → Encryption method → IKEv2 only.
- Option 3 – Gateway object properties > VPN Clients > Authentication → Machine Certificate Authentication → Mandatory.
Against that:
- Your Encryption method is Prefer IKEv2, support IKEv1. Since IKEv1 remains enabled, the vulnerable condition ("IKEv1 is enabled for remote access") still holds — so this doesn't satisfy Option 2.
- Your Machine Certificate Authentication is set to When Available rather than Mandatory, and in Global properties rather than the gateway object. "When Available" doesn't demand a machine certificate, so the vulnerable condition ("gateways do not demand a machine certificate") still holds — so this doesn't satisfy Option 3.
- That leaves Option 1 — could you confirm whether you cleared (unchecked) Allow older clients to connect to this gateway? If it's cleared, that alone is a valid mitigation. If it's still checked, none of the three options are fully in place.
The cleanest way out of both problems: the SK's recommended step is to install the Jumbo Hotfix Accumulator containing the fix —
- R81.20 → Take 146
- R82 → Take 107
- R82.10 → Take 24
- R81.10 → Take 187
Once patched, you no longer need the configuration workarounds, so you can revert the IKEv2 and machine-certificate changes and your macOS clients should behave normally again. Also worth enabling the IPS protection "IKEv1 Remote Access Authentication Bypass PoC Exploit (CVE-2026-50751)" for visibility — the SK is explicit that it's for detection, not remediation.
One more note from Option 1's documentation: clearing Allow older clients is documented to block StrongSWAN, L2TP and legacy clients (e.g. ATMs). The Check Point macOS Endpoint client E89.20 shouldn't be affected by that, but it's worth knowing if you have any of those in the environment.
Suggested order:
- Tell us your gateway version + JHF take (as @PhoneBoy asked) — that determines whether IKEv2 was ever viable for you.
- Revert the Encryption method → test macOS → confirms the trigger.
- Plan the JHF upgrade to the fixed take.
- Until patched, make sure at least one mitigation option is implemented exactly as sk185033 specifies.
References: sk185033 (CVE-2026-50751 advisory) and sk166415 (Support for IKEv2 in Remote Access VPN Clients).
Hope this helps!
Best regards,
Jorge Dias Junior
